Mumbai: The State Bank of India (SBI) has confirmed a data breach involving 3,897 customer records containing personal information that were identified during a preliminary analysis of data found on the dark web.
In a notice to stock exchanges, the country’s largest lender said it received alerts from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) on October 16. The bank subsequently activated its cyber incident response protocols and commissioned an independent cybersecurity agency to investigate the incident.
The preliminary assessment examined a dataset of approximately 3.75 lakh records allegedly leaked by a threat actor operating under the name Siriusim. The exposed information reportedly includes customers’ names, registered mobile numbers, dates of birth, email addresses, residential addresses, branch details and customer identification numbers, along with loan-related records.
SBI said a detailed investigation was underway to establish the authenticity, source and extent of the alleged exposure and assess potential risks.
The bank clarified that the incident had no material impact on its core business operations, financial performance or business continuity. It added that remedial and preventive measures were being implemented.
The authenticity and completeness of the exposed dataset are yet to be independently established.
